Here is a quick anatomy of the file  First of all you won't get infected if you watched the video you will get infected if you downloaded the file in the video description [megaupload link]. It is a visualbasic file It steals your \Bitcoin\wallet.dat. It collects your conputer information. It connects to smtp.gmail.com and sends an email to xplxOdy@hotmail.com with the info. E.G: Wallet taken from:
System Information
Operating System
Platform
Version
User
Language
Network
Display
Resolution
Workspace
Client-IP
It's pooly coded, most likely a ripped source or something, not custom made, i doubt it will succeed in stealing your info  Nice work! Get the smtp password, log into gmail and set up a forward + delete rule, send the stolen coins to the faucet  |
|
|
|
|
That's stupid. Even if it can inject a payment into your wallet, that doesn't mean you can spend the funds on the network; you just have a corrupted wallet!
Most likely a scam that empties your wallet too.
|
|
|
|
|
Ah, okay...
Idea: copy the wallet and export the private keys using bitcoin-tools, compile the latest experimental client from git and import the keys into a new wallet (the ones that received coins).. the record of the transaction being broadcast to the network will not exist in the new wallet, so you can double-spend them to a different address in your new wallet.
Edit: It's possible to transfer keys between your old wallet and a blank one by using pyWallet.
|
|
|
|
People can have my encrypted content in dropbox, they'll be brute-forcing it until the end of the universe.
Really? See link above. I don't think Dropbox has been probed to the fullest extent and the way you can extremely easily share files is what behooves me to not store ANYTHING there that I would want easily shared. I don't care, it's encrypted with a password that is twice as long as this sentence. I can host it in public, nobody's going to get in without knowing my ridiculously long and convoluted password. |
|
|
|
|
Won't starting the client with --rescan fix this?
|
|
|
|
|
I haven't read the source yet, but can we get some form of license for this, in case people want to fork and/or transcribe it into to other languages?
It would be cool if it were a license that is compatible with the official client so it can be added as a patch, or added to SafeBit or bitcoin-alt and so on.
|
|
|
|
|
People can have my encrypted content in dropbox, they'll be brute-forcing it until the end of the universe.
|
|
|
|
|
I'd personally prefer a cyclic pool of keys (along with an anonymity warning) rather than having to back up my wallet every time I make a transaction.
|
|
|
|
Yeah, you make good points. I guess what's needed is for the devs of the different apps to get together and simplify the standard. Since I'm not actually doing any hacking on these projects I guess my opinion holds no weight, but it's nice to rant about them anyway  |
|
|
|
The wikipedia article was written a while back, when some newspapers in Korea wanted to run a story about our school. I had to put up some info so that people would have a reference, but the wikipedia community deemed it as not notable (and rightfully so). I agreed with the decision, but didn't appreciate that most of the people behind it were just (as in this case) internet trolls trying to cause trouble. I don't understand, are you saying that the people who got your vanity page deleted from Wikipedia were Internet trolls, or that the people who wrote the page were trolls? I truly believe in the idea of the UABCI. If it hurts it, I'll leave. Help the UABCI though. UABCI and efforts like it are the only chance Bitcoin has to being accepted mainstream. IMO your ideas are too centralized and look too much like grabs for power and fame, specially with all the fancy sounding titles and faux corporate management-speak. Decentralized, open, all-inclusive systems with no bullshit would be far more trustworthy, but wouldn't offer any personal gain. |
|
|
|
Superb, that makes sense. Thanks for clarifying |
|
|
|
|
I agree that it seems sensible apart from the hex digits and non-standard exponent, the only virtue of the exponent is that it would discourage people from storing the values in IEEE floats, which are susceptible to rounding error. The hex thing is just plain unforgivable and should rightly be as ignored as hex floats are.
edit: the semicolon thing should also be ignored IMO. Everyone is used to ampersands whether Tim Berners-Lee likes it or not, we're used to parsing them by now.
I can see two ways around the incompatibilities, either label this as version 1.0 of the standard and rename the amount parameter to something else (send?), or have someone rewrite the entire thing, debate it, then actually submit it as an RFC to be forever set in stone.
There are also other things aside from the URI scheme that are worth defining if they haven't been already, for example an XHTML microformat for sharing addresses inline in HTML, plus a way to embed addresses in a vCard or address book.
|
|
|
|
|
What type of transactions are we talking about here? Would you need to actually spend BTC to reveal information?
Can anyone who is familiar with the network source give us a breakdown of how this attack would work?
|
|
|
|
Bruce if you get a serious bounty going I will donate 10+ BTC so we can hire a private investigator and get to the bottom of this...
Spend the bounty hiring a private investigator? Surely it would make more sense to pay a private investigator using some other high risk investment pool, with the benefactors claiming the bounty. Spending the bounty before Tom is found is not a good idea for the community IMO, unless it's an investigation pool rather than a bounty on his head. |
|
|
|
|
I agree that Flexcoin should learn from this and lead the way by giving bounties and offering up a clear bug-resolution policy. Pay a reasonable fee for each vulnerability, allow the researcher to publish after a fixed period of time (regardless of whether the bug is fixed or not), and list all fixed vulnerabilities on the site along with the bounty paid.
A history of this sort of security policy would be strong evidence that sites that hold BTC are both secure and honest about their shortfalls.
|
|
|
|
The trouble is that the capital-owning class that becomes a robot-owning class will have no reason to permit everyone else access to the products created by those robots, because they'll have nothing to offer in return. (Actually I can think of a handful of things they could offer, but most of them are really not very pleasant and there wouldn't be enough demand for them anyway.) I completely agree. Like I said in an earlier post, unless we completely reform our ideas of property the vast majority of us are doomed. |
|
|
|
|
I can't view videos in work. What's all this about?
|
|
|
|
I mean if the coins do get moved to another wallet is'nt tracable through blockexplorer? if so couldn't the network and trade site ban that address from cashing in?
Say you buy $500 of bitcoins from someone on IRC, and this turns out to be stolen BTC. Who loses out? |
|
|
|
|
Lost my original wallet with a small deposit from the faucet: lost 0.05BTC
Lost my mybitcoin password in a password-reset frenzy and conversion from KeePass1 to KeePass2: lost 1BTC
|
|
|
|
|
He doesn't seem malicious to me, but I wouldn't trust him with my time or money because from what I've read he's a tool.
|
|
|
|
|
Show Posts
